Dropbox breach seemingly caused by egregious authentication failure
Multiple Dropbox users have been emailed by the cloud storage company to advise them that a security breach saw unauthorised access to their account. The root cause appears to be a lack of authentication by Dropbox when attackers created a single sign-on option through a third-party company … more…
Dropbox users have been notified of a security breach that allowed unauthorized access to their accounts between August 4 and August 21, 2026. The company's email stated that while no files were viewed or downloaded, an issue with a single sign-on (SSO) option using Lenovo IDs was to blame. Dropbox partners with Lenovo for identity verification, allowing users to log in with their Lenovo IDs.
The breach occurred due to a lack of authentication by Dropbox when attackers created the SSO option. According to developer Yoni Levy, an unauthorized party registered a Lenovo ID using a victim's email address and then used it to gain access to the associated Dropbox account. While Lenovo's email verification process was reportedly flawed, the critical issue lies with Dropbox, which failed to verify the linked ID before it could be used to sign in.
To address the issue, Dropbox has fixed the flaw and expired all sessions previously authenticated through a Lenovo ID. Users are advised to take additional security measures to protect their accounts. The company has since rectified the problem and is working to prevent future occurrences.
Written by urgent.news from 9to5Mac's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
